_/_/_/_/ _/_/_/ _/_/_/_/ _/ _/ _/_/_/_/ _/_/_/_/
_/ _/ _/ _/ _/ _/ _/ _/ _/
_/ _/ _/_/_/_/ _/_/_/_/ _/_/ _/_/_/_/
_/ _/ _/ _/ _/ _/ _/ _/
_/_/_/_/ _/_/_/ _/ _/ _/ _/_/_/_/ _/ _/
==========================================================================
Newsletter of the IEEE Computer Society's TC on Security and Privacy
Electronic Issue 58 January 15, 2004
Hilarie Orman, Editor Sven Dietrich, Assoc. Editor
cipher-editor @ ieee-security.org cipher-assoc-editor @ ieee-security.org
Bob Bruen, Book Review Editor, cipher-bookrev @ ieee-security.org
==========================================================================
The newsletter is also at http://www.ieee-security.org/cipher.html
Contents:
* Letter from the Editor
* Upcoming events - conferences and workshops dates and paper
submission dates
* New conference and workshop announcements
* Commentary and Opinion
o Review of the 19th Annual Computer Security Applications
Conference (ACSAC), (Las Vegas, NV, USA, December 8-12, 2003)
by Jeremy Epstein
o Robert Bruen's review of "Exploiting Software. How to Break Code"
by Greg Hoglund and Gary McGraw
o Robert Bruen's review of "Building Open Source Network Security
Tools. Components and Techniques,"
by Mike D. Schiffman
o Robert Bruen's review of "Linux Security Cookbook. Security Tools
& Techniques"
by Daniel Barrett, Richard Silverman and Robert Byrnes
o Book reviews, Conference Reports and Commentary and News items
from past Cipher issues are available at the Cipher website
* Reader's guide to recent security and privacy literature,
* List of Computer Security Academic Positions, by Cynthia Irvine
* Staying in Touch
o Information for subscribers and contributors
o Recent address changes
* Interesting Links and New reports available via FTP and WWW
* Links for the IEEE Computer Society TC on Security and Privacy
o Becoming a member of the TC
o TC Officers
o TC publications for sale
====================================================================
Letter from the Editor
====================================================================
Dear Readers:
The IEEE Technical Committee on Security and Privacy has rotated its
officers. Welcome to all the newly posted officials. Heather Hinton
takes over as Chair, and at long last, there is a treasurer, Tom Chen.
Also, the TC is now one of the sponsors of a new conference on email
security and anti-spam research (CEAS).
The computing world moves on, bloated by spam email and fraught
with the daily security alerts. Now that we have new legislation
affecting spam, where's the beef? Have you seen less annoying
email or more? I'm running at about 10:1, and the anti-spam
filters used by my ISP tend to discriminate against my relatives.
Perhaps the new conference will elicit research results to help us all.
This month's book review theme is attacks on software. It is
an endless subject, and there surely will be more to be said on
both sides of the battle.
I invite any of you who have interests in following a particular
security area to become a regular reporter to Cipher. Intrusion
detection, cryptography, network protocols, etc. are areas where
good summaries would be well-received.
Communicate safely,
Hilarie Orman
Cipher Editor
cipher-editor @ ieee-security.org
====================================================================
Conference and Workshop Announcements
====================================================================
====================================================================
Upcoming Calls-For-Papers and Events
====================================================================
The complete Cipher Calls-for-Papers is located at
http://vulcan.ee.iastate.edu/~cipher/cfp.html
The Cipher event Calendar is at
http://www.cs.utah.edu/flux/cipher/cipher-hypercalendar.html
____________________________________________________________________
Cipher Event Calendar
____________________________________________________________________
1/25/04: USENIX Security, San Diego, California, submissions are
due; conference@usenix.org
1/26/04: ICWS, Conference on Web Services, San Diego, California,
Submissions are due; jain@uwm.edu,
http://conferences.computer.org/icws/2004/
1/26/04: WPET, Workshop on Privacy Enhancing Technologies,
Toronto, Canada; Submissions are due; owens@utoronto.ca
http://petworkshop.org/
1/27/04: 17th CSFW, Computer Security Foundations Workshop,
Pacific Grove, CA; Submissions are due;
focardi@dsi.unive.it,
http://www.csl.sri.com/csfw/index.html
1/28/04: (deadline extension) ACNS '04, Applied Cryptography and
Network Security Yellow Mountain, China; submissions are due,
http://www.rsasecurity.com/rsalabs/staff/bios/mjakobsson/acns.htm
1/30/04- 1/31/04: WHOLES, A Multiple View of Individual Privacy
in a Networked World, Stockholm, Sweden
http://www.sics.se/privacy/wholes2004 1/30/04: SIGCOMM,
Portland, Oregon; Submissions are due;
yavatkar@intel.com
1/31/04: DIMVA, Detection of Intrusions and Malware and
Vulnerability Assessment, Dortmund, Germany; submission are due;
http://www.gi-fg-sidar.de/dimva2004
1/31/04: CEC 2004, special session on crypto and compsec,
Portland, Oregon; Submissions are due; isasi@ia.uc3m.es
http://www.ohmsha.co.jp/ngc
2/ 5/04- 2/ 6/04: NDSS, Network and Distributed System Security
Symposium, San Diego, California,
http://www.isoc.org/isoc/conferences/ndss/04
2/ 5/04- 2/ 7/04: FSE, Fast Software Encryption, Delhi, India
http://www.isical.ac.in/~fse2004/
2/ 9/04- 2/12/04: FC, Financial Cryptography, Key West, FL
http://ifca.ai/fc04/CFP.htm
2/ 9/04: CCCpyrt, Colleges, Code and Copyright, Adelphi,
Maryland; abstracts are due; ofrancois@umuc.edu
http://www.umuc.edu/odell/cip/symposium/cpapers.html
2/10/04: CRYPTO 2004, Santa Barbara, CA; Submissions are due;
James_Hughes@storagetek.com
http://www.iacr.org/conferences/c2004/cfp.html
2/15/04: Euro PKI, Samos island, Greece; Submissions are due;
ska@aegean.gr, http://www.aegean.gr/EuroPKI2004/
2/19/04- 2/21/04: TCC, Theory of Cryptography, Cambridge, MA
http://www-cse.ucsd.edu/users/mihir/tcc/tcc04/cfp.html
2/25/04- 2/26/04: Information Assurance, Arlington, VA;
http://www.idga.org
2/28/04: TRUSTBUS, Trust and Privacy in Digital Business,
Zaragoza, Spain; Submissons are due
http://www-ifs.uni-regensburg.de/trustbus04/
3/ 1/04- 3/ 4/04: PKC, Public Key Infrastructure Research
Workshop, Singapore, http://www.i2r.a-star.edu.sg/pkc2004/
3/ 3/04- 3/ 5/04: PRDC, Pacific Rim International Symposium on
Dependable Computing, Papeete, Tahiti, http://www.laas.fr/PRCD10
3/11/04: WSEG, Brazilian Workshop On Security Of Computing
Systems, Gramado, Brazil; Submissions are due;
paschoal@exatas.unisinos.br,
http://www.sbrc2004.ufrgs.br/
3/14/04: PerSec, Workshop on Pervasive Computing and
Communication Security , Orlando, Florida,
http://www.list.gmu.edu/persec
3/26/04: ESORICS, European Symposium on Research in Computer
Security, French Riviera, France; Submissions are due;
Refik.Molva@eurecom.fr, http://esorics04.eurecom.fr
3/29/04- 3/31/04: AINA, International Conference on Advanced
Information Networking and Applications, Fukuoka,
Japan,http://www.takilab.k.dendai.ac.jp/conf/aina/2004
3/31/04: RAID, Recent Advances in Intrusion Detection, French
Riviera, France; Submissions are due; molva@eurecom.fr,
http://raid04.eurecom.fr
4/ 2/04: ISC, Information Security Conference, Palo Alto, CA
Submissions are due; isc04inquiry@uncc.edu;
http://isc04.uncc.edu
4/ 2/04: WISP, Security Issues with Petri Nets and other
Computational Models, Bologna, Italy; Submissions are
due; busi@cs.unibo.it;
http://www.iit.cnr.it/staff/fabio.martinelli/WISP2004cfp.html
4/ 5/04- 4/ 7/04: IAS, Information Assurance and Security, Las
Vegas, Nevada;
http://www.cs.okstate.edu/~aa/itcc04/itcc04.html
4/ 5/04- 4/ 7/04: ITCC, International Conference on Information
Technology Coding and Computing, Las Vegas, NV;
http://www.isebis.eng.uerj.br/crypto2004.html
4/ 8/04- 4/ 9/04: IAW, IEEE International Information Assurance
Workshop, Charlotte, NC; http://iwia.org/2004
4/14/04- 4/17/04: IAWS, Workshop on Information Assurance ,
Phoenix, Arizona; http://www.tele.pitt.edu/~sais/iaws04
4/16/04: CEAS, Conference on Email and Anti-spam, Mountain View,
CA; Submissions are due; information@ceas.cc; http://www.ceas.cc
5/ 3/04: CCS-11, ACM Conference On Computer And Communications
Security, Washington DC, Submissions are due;
http://www.acm.org/sigsac/ccs/CCS2004
5/ 9/04- 5/12/04: Security and Privacy 2004, Oakland, CA;
http://www.cs.berkeley.edu/~daw/oakland04-cfp.html
____________________________________________________________________
Journal, Conference and Workshop Calls-for-Papers
New since Cipher E57
____________________________________________________________________
o ACNS'04 The 2nd conference of Applied Cryptography and Network
Security, Yellow Mountain, China, June 8-11, 2004. (Extended
submission deadline: January 28, 2004).
o PET'2004 4th Workshop on Privacy Enhancing Technologies, Toronto,
Canada, May 26-28, 2004. (Submission deadline: January 26, 2004).
Privacy and anonymity are increasingly important in the online
world. Corporations and governments are starting to realize their
power to track users and their behavior, and restrict the ability to
publish or retrieve documents. Approaches to protecting individuals,
groups, and even companies and governments from such profiling and
censorship have included decentralization, encryption, and distributed
trust. Building on the success of the previous workshops, this
workshop addresses the design and realization of such privacy and
anti-censorship services for the Internet and other communication
networks. A list of topics of interest along with instructions for
submitting a paper can be found at the workshop web site at
http://petworkshop.org/2004/
o CEC'2004 IEEE CEC 2004 Special Session on Evolutionary Computation in
Cryptology and Computer Security, Portland, Oregon, USA, June 20-23,
2004. (Submission deadline: January 31, 2004).
Techniques taken from the field of Evolutionary Computation
(especially Genetic Algorithms, Genetic Programming, Artificial Immune
Systems, but also others) are steadily gaining ground in the area of
cryptology and computer security. In recent years, algorithms which
take advantage of approaches based on Evolutionary Computation have
been proposed, for example, in the design and analysis of a number of
new cryptographic primitives, ranging from pseudorandom number
generators to block ciphers, in the cryptanalysis of state-of-the-art
cryptosystems, and in the detection of network attack patterns, to
name but a few. The special session encourages the submission of novel
research at all levels of abstraction (from the design of
cryptographic primitives through to the analysis of security aspects
of "systems of systems"). This special session
will promote further co-operation between specialists in evolutionary
computation (and its current partners such as biology), computer
security, cryptography and other disciplines, and will give interested
researchers an opportunity to review the current state-of-art of the
topic, exchange recent ideas, and explore promising new directions. A
list of topics of interest along with instructions for submitting a
paper can be found at the workshop web site at
http://tracer.uc3m.es/cec2004ss.html
o I-NetSec04 Third Working Conference on Privacy and Anonymity Issues in
Networked and Distributed Systems (special track at the 19th IFIP
International Information Security Conference), Toulouse, France,
August 23-26, 2004. (submissions due February 9, 2004)
Privacy and anonymity are increasingly important aspects in electronic
services. The workshop will focus on these aspects in advanced
distributed applications, such as m-commerce, agent-based systems,
P2P, ... Suggested topics include, but are not restricted to:
- Models for threats to privacy/anonymity
- Models and measures for privacy/anonymity
- Secure protocols that preserve privacy/anonymity
- Privacy, anonymity and peer-to-peer systems
- Privacy, anonymity and mobile agents
- Privacy/anonymity in payment systems
- Privacy/anonymity in pervasive computing applications
- Anonymous communication systems
- Legal issues of anonymity
- Techniques for enhancing privacy in existing systems
More information can be found at http://www.sec2004.org
o 1st Euro PKI 1st European PKI Workshop Research and Applications,
Samos island, Greece, June 25-26, 2004. (submissions due February 15,
2004)
The 1st European PKI Workshop: Research and Applications is focusing
on research and applications on all aspects of Public Key
Infrastructure. Submitted papers may present theory, applications or
practical experiences on topics including, but not limited to:
- Modeling and Architecture - Key Management and Recovery
- Bridge CA - Certificate Status Information
- Cross Certification - Interoperability
- Directories - Repository Protocols
- Mobile PKI - Timestamping
- Authentication - Verification
- Reliability in PKI - Standards
- Certificate Policy - Certification Practice Statements
- Privacy - Legal issues, Policies & Regulations
- Fault-Tolerance in PKI - Case Studies
- Privilege Management - Trust
- PKI and eCommerce, eBusinees, eGovernment applications
More information can be found on the conference web site at
http://www.aegean.gr/EuroPKI2004
o Cybercrime and Digital Law workshop, Yale University Law School,
New Haven, CT, USA, March 26-28, 2004. (submissions due February
15, 2004)
The Information Society Project at Yale Law School is pleased to
announce its upcoming conference on Cybercrime and Digital Law
Enforcement entitled: "Digital Cops in Virtual Environment." This
ground-breaking conference will bring together policy makers, security
experts, law enforcement personnel, social activists and academics to
discuss the emerging phenomena of cybercrime and law enforcement. The
conference will question both the efficacy of fighting cybercrime and
the civil liberties implications arising from innovations in law
enforcement methods of operation. For further information, see the
call for papers and writing competition at
http://islandia.law.yale.edu/isp
o Trustbus'04 Trust and Privacy in Digital Business, Zaragoza, Spain,
August 30 - September 3, 2004. (submissions due February 28, 2004)
The First International Conference on Trust and Privacy in Digital
Business (TrustBus '04) will be held in conjunction with the
15th International Conference on Database and Expert Systems
Applications (DEXA'04), (http://dexa.org/dexa2004/).
TrustBus '04 shall bring together researchers from different
disciplines, developers, and users all interested in the critical
success factors of digital business systems. We invite papers,
work-in-progress reports, industrial experiences describing advances
in all areas of digital business applications. A complete list of
topics of interest and instructions for submitting a paper can be
found on the conference web site at
http://www-ifs.uni-regensburg.de/trustbus04/
o CHES 2004 Cryptographic Hardware and Embedded Systems, Cambridge
(Boston), USA, August 11-13,2004. (submissions due March 2, 2004)
The focus of this workshop is on all aspects of cryptographic hardware
and security in embedded systems. Of special interest are
contributions that describe new methods for efficient hardware
implementations and high-speed software for embedded systems, e.g.,
smart cards, microprocessors, DSPs, etc. We hope that the workshop
will help to fill the gap between the cryptography research community
and the application areas of cryptography. The topics of CHES 2004
include but are not limited to:
- Computer architectures for public-key and secret-key cryptosystems
- Efficient algorithms for embedded processors
- Reconfigurable computing in cryptography
- Cryptographic processors and co-processors
- Cryptography in wireless applications (mobile phone, LANs, etc.)
- Security in pay-TV systems
- Smart card attacks and architectures
- Tamper resistance on the chip and board level
- True and pseudo random number generators
- Special-purpose hardware for cryptanalysis
- Embedded security
- Device identification
More information can be found at http://www.chesworkshop.org
o WSEG 2004 Fourth Brazilian Workshop on Security of Computing Systems,
Gramado, Brazil, May 10th, 2004. (submissions due March 11, 2004)
The 4th Brazilian Workshop on Security of Computing Systems (WSeg
2004) will be held in conjunction with the 22nd Brazilian Symposium on
Computer Networks (SBRC 2004) on May 10, 2004 in Gramado. Its main
purpose is to promote discussions of research and relevant activities
in security-related subjects. Authors are invited to submit papers
describing research projects, experimental results and recent
developments related, but not limited, to the following topics:
- Adaptive security - Analysis of malicious code
- Analysis of network and security protocols
- Attacks against networks and machines
- Auditing - Biometry and biometric systems
- Computer forensics - Cryptography and digital certification
- Firewall technologies - Internet security
- Intrusion detection - Public key infrastructure
- Security against intrusions - Security legal issues
- Security of distributed systems - Security of agents and mobile code
- Security of e-commerce - Security of networks
- Security of operating systems - Security of voting systems
- Techniques for developing secure systems
- Security policies
- Authentication and authorization of users, systems, and applications
More information can be found at the workshop web site at
http://www.sbrc2004.ufrgs.br/
o ESORICS 2004 9th European Symposium on Research in Computer Security,
Institut Eurecom, Sophia-Antipolis, French Riviera, France, September
13-15, 2004. (submissions due March 26, 2004)
Papers offering novel research contributions in any aspect of computer
security are solicited for submission to ESORICS 2004. Organized in a
series of European countries, ESORICS is confirmed as the European
research event in computer security. The primary focus is on
high-quality original unpublished research, case studies and
implementation experiences. We encourage submissions of papers
discussing industrial research and development. Information on topics
of interest, and instructions for submitting a paper can be found at
http://esorics04.eurecom.fr
o RAID'2004 Seventh International Symposium on Recent Advances in
Intrusion Detection, Institut Eurécom, Sophia-Antipolis, French
Riviera, France, September 15-17, 2004. (submissions due March 31, 2004)
For RAID 2004 there is a special theme: the interdependence between
intrusion detection and society. Thus, we will also welcome papers
that address issues that arise when studying intrusion detection,
including information gathering and monitoring, as a part of a larger,
not necessarily purely technical, perspective. The RAID 2004 program
committee invites three types of submissions: full papers presenting
mature research results; practical experience reports describing a
valuable experience or a case study; and panel proposals for
presenting and discussing hot topics in intrusion detection
systems. The RAID 2004 web site elaborates on these themes and also
provides a full list of topics of interest (http://raid04.eurecom.fr)
o EAS The First Conference on Email and Anti-Spam, Mountain View, CA,
USA, July 30-31, August 1, 2004. (submissions due April 16, 2004)
The Conference on Email and Anti-Spam invites the submission of papers
for its first meeting, held in cooperation with AAAI (the American
Association for Artificial Intelligence). Papers are invited on all
aspects of email and spam, including research papers (Computer science
oriented academic-style research), industry reports (Descriptions of
important or innovative products), and law and policy papers. A full
list of topics can be found on the conference web site at
http://www.ceas.cc
o CCS 2004 11th ACM Conference on Computer and Communications Security,
Washington, DC, USA, October 25-29, 2004. (submissions due May 3, 2004)
Research track papers are due May 3, 2004. Industry track proposals
are due July 15, 2004 (see the separate call at
http://www.acm.org/sigsac/ccs/CCS2004 for details). Proposals for
90-minute tutorials are due May 3, 2004. Proposals for full-day
or half-day workshops are due December 1, 2003 (see the separate call at
http://www.acm.org/sigsac/ccs/CCS2004 for details).
====================================================================
News Briefs
====================================================================
News briefs from past issues of Cipher are archived at
http://www.ieee-security.org/Cipher/NewsBriefs.html
[Contributions are welcome]
=============================================================================
News Items
January 6, 2004, about the World Summit on the Information Society,
http://www.itu.int/wsis/, Carl Landwehr wrote:
The UN/ITU "World Summit on the Information Society" held in Geneva
last month. It generated a "Declaration of Principles" including
"Building confidence and security in the use of ICTs" (note: "ICT" =
"Information and Communication Technologies") as one of 11 "Key
Principles" enumerated. Details below. For the whole document, see:
----------------------
B. An Information Society for All: Key Principles
19. We are resolute in our quest to ensure that everyone can benefit
from the opportunities that ICTs can offer. We agree that to meet these
challenges, all stakeholders should work together to: improve access to
information and communication infrastructure and technologies as well as to
information and knowledge; build capacity; increase confidence and security
in the use of ICTs; create an enabling environment at all levels; develop
and widen ICT applications; foster and respect cultural diversity; recognize
the role of the media; address the ethical dimensions of the Information
Society; and encourage international and regional cooperation. We agree that
these are the key principles for building an inclusive Information Society.
----------------------
5) Building confidence and security in the use of ICTs
35. Strengthening the trust framework, including information security
and network security, authentication, privacy and consumer protection, is a
prerequisite for the development of the Information Society and for building
confidence among users of ICTs. A global culture of cyber-security needs to
be promoted, developed and implemented in cooperation with all stakeholders
and international expert bodies. These efforts should be supported by
increased international cooperation. Within this global culture of
cyber-security, it is important to enhance security and to ensure the
protection of data and privacy, while enhancing access and trade. In
addition, it must take into account the level of social and economic
development of each country and respect the development-oriented aspects of
the Information Society.
36. While recognizing the principles of universal and non-discriminatory
access to ICTs for all nations, we support the activities of the United
Nations to prevent the potential use of ICTs for purposes that are
inconsistent with the objectives of maintaining international stability and
security, and may adversely affect the integrity of the infrastructure
within States, to the detriment of their security. It is necessary to
prevent the use of information resources and technologies for criminal and
terrorist purposes, while respecting human rights.
37. Spam is a significant and growing problem for users, networks and
the Internet as a whole. Spam and cyber-security should be dealt with at
appropriate national and international levels.
---------------------------------------------------------------------------
Noted by Richard Schroeppel:
Critical flaws found in VoIP products using H.323 protocol
http://www.computerworld.com/securitytopics/security/story/0,10801,89041,00.html
Story by Jaikumar Vijayan, January 13, 2004, COMPUTERWORLD
The referenced story describes severe security flaws in the H.323
protocol implemenatations by several vendors. These were discovered
by security testing using software developed by the Finland-based Oulu
University Secure Programming Group (OUSPG)
====================================================================
Commentary and Opinion
====================================================================
Book reviews from past issues of Cipher are archived at
http://www.ieee-security.org/Cipher/BookReviews.html, and conference reports
are archived at http://www.ieee-security.org/Cipher/ConfReports.html
____________________________________________________________________
Review of
19th Annual Computer Security Applications Conference (ACSAC)
Las Vegas, NV, USA, December 8-12, 2003
by Jeremy Epstein
____________________________________________________________________
The 19th Annual Computer Security Applications Conference (ACSAC) was held
Dec 8-12 2003 at the Aladdin Hotel in Las Vegas. Despite the fact that it
was in Las Vegas (*), it was a pleasant and productive week.
my notes.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Monday and Tuesday had a number of tutorials, plus a workshop on secure web
services which I attended. The workshop speakers included representatives
from Reactivity, Datapower, IBM, Microsoft, and webMethods (yours truly).
There were almost 50 attendees for the workshop.
One key point was in agreement among all the speakers: standards alone
aren't enough; when you hook up a system using web services, you introduce
new risks that can't be addressed by standards. In particular, web services
definitions (such as WSDL) tell an attacker exactly what a message should
look like, which provides a template to use for creating attacks such as
those using SQL injection. Additionally, web services typically expose data
which would otherwise be much more closely held. So while the fundamental
problems aren't any different from any other network-based service, web
services make the attacker's job somewhat easier, and increase the value of
the target. There was also some agreement that attacks coming from the
inside are at least as risky as attacks from the outside. Simply saying
"it's behind the firewall" isn't good enough.
Several speakers proposed that the proper solution is to use centralized
security devices that enforce all the security requirements in one place,
rather than trying to individually harden every platform that's providing
web services.
Delegation was also proposed as a key problem (as in almost all distributed
systems). But there are many different delegation needs, and it's very hard
to do securely.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The 2003 Distinguished Practitioner was Dr. Clark Weissman from Northrup
Grumman. Clark's presentation was on the architecture for the new avionics
system targeted for 20 years out. A typical (current) military flight will
have information on the airplane from unclassified (such as logistics info)
through Top Secret (such as targets). Because Multi-Level Secure (MLS)
systems aren't readily available today, the aircraft is run as "system high"
(all information is treated as classified as the most classified
information), which makes maintenance difficult. In some cases, the pilot
may not be cleared to see all of the information (such as information about
the specific target until a certain point in the mission).
Based on Moore's law, they expect to have thousands of CPUs available on the
airplane, which will allow building Multi Single Level (MSL) systems, with
one process per processor. The processors at any given classification will
be hooked together using VPNs, so encryption keeps the data separate. High
assurance Encryption Processing Elements (EPEs) safeguard the keys and
provide the encrypted tunnel. A Control Element (CE) can clear the
encryption keys if there's a problem (such as aircraft capture).
They're targeting a Common Criteria EAL7 evaluation (the highest level
defined in the criteria). To make that possible, the trusted portion of the
code (that keeps classified data separate) must be minimized; their target
is under 10,000 source lines of code.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The 2003 Invited Essayist was Lance Spitzner from Honeypot Technologies.
Lance talked about what honeypots are and how they can help. At present,
attackers have the initiative, whether inside or outside the corporate
firewall. Attacking back isn't feasible, because the systems that are doing
the attacking may not be where the threat is (e.g., a case he saw recently
of an attack from a South Korean computer system, but the real attackers
were in Romania).
Most attacks are targets of opportunity - the script kiddies & other
attackers are more interested in the QUANTITY of systems they have than what
information the systems have. Many people don't realize that their home
systems are therefore targets of opportunity. One recent case had 15,000
systems under hackers control, and another that the Navy saw had 140,000
systems under hacker control. Spammers are taking advantage of this (as has
been widely reported) and are taking over home systems to install open
relays and porn sites. The victim (home user) doesn't even know they've
been compromised. Some 30% of spam is transferred this way. The attackers
don't care of they're noisy and get detected, because they have so many
other systems under control. It only takes 15 minutes (on average) from
when a vulnerable system is connected to the Internet until it's hacked, and
some systems are attacked while they're still in the process of being
installed. Some hackers are using this for extortion.
The real threat, by contrast, is Targets Of Choice. These types of attacks
are more likely to be happening from the inside, and the attackers don't
want to be detected. There's lots of information out there on exploits, but
relatively little on how the bad guys are organized, motivated, etc.
Honeypots give an opportunity to see what they're up to, by giving you the
initiative. Honeypots can be used as a "fixing mechanism": if you set up a
honeypot that's "vulnerable" to Code Red (i.e., so a Code Red attack goes
after it), then it can turn around and attack that system and install the
patch to make it immune. Similar tactics are possible against spammers.
Honeypots also give you a chance to see attacks without the false positives
of an IDS, since (nearly) everything that gets picked up by a honeypot is an
attack (so there's a very good signal/noise ratio). A honeypot also works
in environments where you have SSL & SSH, unlike IDSs which can't see the
traffic. However, honeypots have disadvantages such as a limited field of
view (they only see what they're attacked with) and the risk that if they're
not done carefully they could spread an attack. To make honeypots easier to
use, the honeypot community is coming out in spring 2004 with a bootable
CD-ROM that turns a machine into a honeypot.
They have two hypotheses on catching advanced insiders: redirection and
honeytokens. Redirection requires making a honeypot a duplicate of a real
system, and redirect things that look suspicious into the duplicate copy for
closer surveillance. Finding the suspicious things can be based on
hotzoning (watching for any attempts to access non-production ports, such as
trying to connect to a telnet port on a mail server), known attacks, or bait
& switch. Honeytokens are based on putting in false information, such as
creating fake user accounts that don't belong to anyone, and looking for
attempts to access them (which indicates dictionary attacks or offline
cracking).
His 10 year prediction is that honeypots will grow in importance in
government and academia, but not substantially in the commercial world.
They'll never be as ubiquitous as firewalls.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Following are some of the papers I found most interesting:
"Bayesian Event Classification for Intrusion Detection" was presented by
Christopher Kruegel from UC Santa Barbara. Typical IDSs with multiple
models sum the output of the models and compare to a threshold, which
doesn't capture the relationship of models, or external information. The
result is too many false positives or false negatives, depending on the
tuning settings. Their goal is to use a Bayesian network to reduce the
false positives, by representing the interdependencies of the different
models. They build a set of models - one for each type of system call
(e.g., filesystem operations) - which gives a total of four models for UNIX
system call monitoring. They then put the models together looking at the
relationships. They claim that the resulting system was always better than
a threshold-based system. An audience member asked whether that was an
artifact of the Lincoln Labs data used for testing; the speaker said it was
not.
"Information Detection: A Bio-Informatics Approach" was presented by Scott
Coull from Rensselaer Polytechnic Institute (and was the winner of the "best
student paper" award). Their idea is to use some of the techniques used in
DNA matching to try to find relationships between actions and signatures of
attacks. The idea is to find one or more alignments, where an alignment can
be global (finding the most overall alignments) or local (finding the
largest block of alignments). For experimentation, they looked for patterns
in system call captures from the "acct" UNIX command. They used semi-global
alignment, and made it highly tunable by adjusting penalties and bonuses for
gaps and matches. They don't know what the proper model is, though, and in
particular what are acceptable mutations. An audience member asked whether
users can be differentiated using this approach (e.g., for forensics); they
didn't know. They accommodate changing behavior over time using "concept
drift" which changes the match levels over time without changing user
signatures.
"Design, Implementation and Test of an Email Virus Throttle" by Matt
Williamson of HP Labs was presented by a colleague, as Matt's wife was 9
months pregnant at the time. This paper extends Matt's work which one the
"best paper" award at ACSAC last year. The idea is to throttle the load
based on new email destinations, just as his paper last year looked at
throttling TCP connections to new hosts to keep worms from using a subverted
system to attack other systems. They empirically found that there's a low
repeatability of recipients: if you send a message to Jane Doe, the odds are
relatively low that the next message (or the next few) will also be to Jane
Doe. This is in contrast to web pages, where there's a lot of locality (the
odds are high that the next page will come from the same host as one of the
past few pages). To avoid unnecessarily slowing down email processing, they
look at "slack" time: if you're idle for a while, the throttle is relaxed to
allow sending more messages. Unlike the TCP throttle, there's no "working
set" maintained because of the lack of locality, just a limit of messages
per unit time. The throttle doesn't block messages, but only queues them
and dribbles them out. This is an effective way to control email worms. A
throttle can be implemented in the client, in the server, or in a proxy.
"Practical Random Number Generation Software" was presented by John Viega
from Virginia Polytechnic Institute. This paper is a summary of lessons
learned with random numbers in real systems. RNGs and PRNGs are critical to
many systems. However, even if they use hardware, they're not very random.
In software, random data is quite scarce. The goal is to continually
collect entropy from the system, and use metrics to estimate how much you've
got so good random numbers can be provided. Unfortunately, entropy isn't
absolute: it's relative to what the attacker can see, so need to include a
threat model. He suggests that collecting entropy as part of system
initialization is a good idea, since it's one of the few times you can get
the administrator's attention. Most RNG systems tend to overestimate the
entropy available to them, which gives non-random values.
"Isolated Program Execution: An Application-Transparent Approach for
Executing Untrusted Programs" was presented by Zhenkai Liang from Stony
Brook University (and was the winner of the "outstanding paper" award).
Their idea is to create a "virtualized file system" where you can run a
command, and it creates copy-on-write versions of any files you modify.
When the program is finished, you're presented with a list of all the files
that were touched, and can either accept or reject the collected changes.
The prototype they built allows you to diff the old & new versions of a file
to see what changes were made. This is useful to run programs that you
suspect may be malicious but also sound useful, as well as to test out
installing a program without risking it modifying a file you didn't intend.
No change is required to the program being tested. At times, the
virtualization can be pretty tricky, as (for example) when a file or
directory is renamed or deleted, or if permissions are changed. No other
user of the system sees any of the file system changes until the commit is
done; the commit operation fails if there have been other changes made to
the file after the copy-on-write operation occurred (i.e., it doesn't try to
sort out interleaved operations). The prototype is limited to only handling
file operations, which isn't very realistic (you can't "undo" a change made
through a socket to a database), so they disallow all network access. Also,
it may be hard for non-technical users to determine whether a set of changes
is reasonable... how many non-geeks would know that changing a .history file
is perfectly normal?
I missed most of Prof Gene Spafford's classic paper "A Failure to Learn from
the Past", but heard much of the heated debate. The consensus in the
community seems to be that nothing much has changed in the past 15 years
since the Morris Worm, and in fact things are getting worse with respect to
security. Our code is as poorly built as ever; we still suffer from the
same types of flaws. The only difference is that we're more reliant than
ever on our software. The relative diversity of the Internet 15 years ago
helped limit the damage to only 10% of the computer systems; today's near
mono-culture means that nearly everyone is vulnerable to the attack du jour.
While the CERT was formed in reaction to the Morris worm and the lack of
good ways to promptly distribute critical security information, it has
instead become a bottleneck. I was particularly amused by his statement "It
is sobering to realize that our overall infrastructure security might well
be better had UNIX been written in Cobol rather than C." Perhaps most
frightening is the fact that with an increasing use of VoIP phones, in a
future attack we may not even be able to use the telephone as a way to
communicate about the attack. While there are now numerous laws regarding
computer crime, they're hardly ever used.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The spam panel "Miracle Cures and Toner Cartridges: Finding Solutions to the
Spam Problem" was interesting, although there was little new information.
The first speaker, Daniel Faigin from Aerospace, noted that spam is cost
effective: at a response time of 0.05%, 3 million email addresses will yield
1500 hits, which is a good business. Spam has also become a security
problem, as an increasing number of spams are sending viruses and worms.
There's also privacy concerns - web bugs in messages confirm email addresses
even if attachments aren't opened or web sites aren't visited (this is
particularly a problem for Outlook users). The newly-passed legislation in
the US is likely to be useless at all levels, and many even increase spam.
Direct charging for sending messages doesn't work because you can't find out
who a spammer is. For example, if the spammer takes over a user's home
system (as is common), should the owner of that system get charged for the
spam that gets generated by that machine? While it may be philosophically
appealing, it's not realistic.
The second speaker, Matt Bishop from UC Davis, tried to define spam. It's
usually considered "bulk unsolicited email" or "unsolicited commercial
email". But when does something become bulk? If I send to all my friends?
If I send to everyone who attended a conference? When does it become
commercial, and when have you opted in? What is unsolicited? How much of a
relationship must I have with an organization before they can send me
messages? Defining characteristics would make it easier to stop spam.
The third speaker, Tasneem Brutch from Kaiser Permanente noted that they're
taking a pragmatic approach because of the cost to employees for handling
spam. The estimate is that US corporations lost $10 billion/year in
additional hardware to process the spam, lost productivity, IT resources to
eliminate the messages, etc. She believes there must be enough legal &
economic disincentives through federal and international laws to make life
harder for spammers. Tier-1 internet providers must do some blocking.
In the discussion period, someone commented that classified US networks are
using Doubleclick technology to "help" the analyst find related (but
potentially unknown) information. For example, clicking on a document on
one classified site might cause you to get an (unsolicited) classified
message suggesting other sites with related documents. This is a form of
classified spam!
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Copies of all papers (including those by the Distinguished Practitioner and
Invited Essayist) are available on the ACSAC web site (www.acsac.org).
Tutorial and workshop slides are not available.
(*) For me, Las Vegas is like Disneyland (artificial, overpriced, crowded,
and noisy) without any of the charm. YMMV.
===========================================================================
____________________________________________________________________
Book Review By Robert Bruen
January 13, 2004
____________________________________________________________________
==============================================================================
Exploiting Software. How to Break Code. By Greg Hoglund and Gary McGraw.
Addison-Wesley 2004. 448 pages. Index, references, appendix. ISBN
ISBN 0-201-78695-8. $39.99
=========================================================================
Sooner or later, it was bound to happen. Much has been published on how to
defend your network, your web site, and so on. Some has been published on
how to write secure code - although not enough or else not enough has been
read, because the poorly written code still dominates the landscape. Now a
book has been published that truly analyzes how exploit code is designed
and written. We all a debt of gratitude to Aleph1 for "Smashing the Stack
for Fun and Profit" (1996) for the detailed, step by step instructions. It
pushed one more step beyond by explaining the why, not just the how of
writing exploit code. There is a subtle, yet critical difference between
instructions that are followed and an analysis that leads to the
all important understanding. If one understands, then one can do another
time without help. If one does not get it, one continues to simply follow
what others produce.
Exploiting Software dives head first into the why. The explanations are a
serious analysis of why software is vulnerable. This book has been
rightfully called the mirror image of "Building Secure Software," another
important book. It is not enough to be able to use other people's code to
crack systems. The future belongs to those who understand how it works at
the deeper levels and can use that understanding to write secure code or
to write code that exploit insecure code.
Hoglund and McGraw are leading the way to the next phase of software. It
is pretty clear that vendors, such as Microsoft, do not get it. They are
no the only guilty parties, but their failures cause much of the suffering
experienced over the past few years. The future lies at the level of code,
not marketing. While profits are running high, the seeds of destruction
are being sown. The destruction will be unleashed by those who understand
the deepest level of code creation. We must think about the rapid
expansion of a software infrastructure, which is based on quicksand.
Sooner or later, the foundations will give way.
We have books that explain hacking. We have books that give us the
theoretical aspects of software and security. We have books that tell us
how to write software in a secure manner. Now we have a book that analyzes
the methods of exploitation of what we build everyday. Software is what
makes everything work. It is the creative side of technology fulfilling
our imagination to brings dreams and nightmares into reality. It is an
unfortunate truth that human nature is both good and evil. Software is no
different. The only way to see that our technical future will be full of
sunshine is to use our brains to learn about it.
This book is highly recommended. It is one of the important books of this
year. If you are trying to decide whether software vendors are telling you
the truth about their approach to security, you can find an approach that
will help you. If you want to know how those pesky crackers keep breaking
in, the answers are here. If you would like to see the underlying
mechanisms for writing exploit code, look no further. Exploiting Software
delivers where others have only promised.
The topics are covered in a meaningful way. Some of those are classics
like the buffer overflow, other are reverse engineering, cross-site
scripting and malicious input. The real kicker is that the book is cheap
at $40 bucks. The content is worth much, much more. In my opinion books
that move the discipline forward are important. This one is just that.
____________________________________________________________________
Book Review By Robert Bruen
January 13, 2004
____________________________________________________________________
=======================================================================
Building Open Source Network Security Tools. Components and Techniques.
by Mike D. Schiffman. Wiley 2003. 424 pages. Index, references, code.
ISBN 0-471-20544-3 $45.00.
=========================================================================
Many of us have all used open source tools for one thing or
another. How nice it is when someone else does the work, leaving you
only with downloading and installing it. Often enough, the tools are
excellent. In the early days, these tools were tied to particular
operating systems; however, times have changed. Now there are
libraries that not only function across operating systems, but also
make it easier to write the tools.
The downside, of course, is that now you need to learn the
libraries. And there are several of them. One benefit and problem with
open source is that there is a constant flow of new code. When you
find that cool tool that does just you want, you need to go find the
other required code to make it work. There are at least a half dozen
libraries for network tools, not to mention the GUI code that improves
the interface. It is probably better that we do not have a monoculture
of security libraries, but it means that we have to know more about
the various libraries.
This is where Schiffman's book comes it. He has put together some of the
clearest explanations of the most common network security libraries to
date. He has full chapters on Libpcap, Libnet, Libnids, Libsf, Libdnet
and OpenSSL. Each chapter details the installation, datatypes,
dependencies and functions of each library. He also provides working code
examples which uses each library. If you want to write a cool tool, start
here.
The other half of the book details techniques: Passive and Active
Reconnaissance, Attack and Penetration, and Defensive techniques. The
presentation of each technique is clear, easy to follow and culminates in
working code. The source of all the code is available online. C is his
language of choice, which is actually quite readable, unlike a lot of C
code. A software development lesson is included in the book and his code
reflects his understanding of things like modular code, comments,
meaningful variable names, etc. Even flow charts appear.
Building Open Source Network Security Tools is a pleasure to read. It is
obvious that Schiffman knows what he is talking about. The last chapter is
an in depth look at his tool Firewalk, with complete source code. Firewalk
was developed to get around limitations imposed on traceroute. More than a
few tool developers could benefit from his description of the process used
to develop Firewalk. The requirements are listed, as are the analysis and
design pieces. Such discipline has not received its just due for quite a
while. Perhaps that is the reason that so much vendor code is less than
adequate.
This is a highly recommended book for anyone who wants to develop
network security tools and for anyone who wants to understand the
technical details that the good tool writers know. More work needs to be
done in this arena and here is the leader.
____________________________________________________________________
Book Review By Robert Bruen
January 13, 2004
____________________________________________________________________
=====================================================================
Linux Security Cookbook. Security Tools & Techniques by Daniel Barrett,
Richard Silverman and Robert Byrnes. O'Reilly 2003. 311 pages.
Index. ISBN 0-596-00391-9 $39.95
=========================================================================
There are a number of good Linux Security books out there, for
example, Real World Linux Security, Hacking Linux Exposed,
Hackproofing Linux and Linux Security, so why another one? Each book
has its strengths and weaknesses, no one book does it all. Each has
its own mission and approach. Cookbooks in general are helpful because
they condense the problems into a short, easy to follow recipes. They
are not intended to be read at one sitting. When you need a method to
follow without requiring the theory, the cookbook is the place to go.
The value of cookbook is determined by how good it is. Is the coverage
broad enough and is it the correct coverage? Are the recipes easy to
follow? Do they actually work? Do the authors know what they are
doing? No cookbook will replace a total security plan, but a good
cookbook should be part of the plan.
The Linux Security Cookbook answers all these questions in the
affirmative. The authors realize their book is just part of an overall
plan and they make it fit in properly. It can be used as the
quick-start for the impatient or as a dictionary by the forgetful who
drop a step in some piece of software. One of the important uses is as
a checklist. Very few of us know everything or can remember it all
even if we did. You can either look up a specific problem, such as how
to encrypt Pine email or you can just open it up to a random spot and
read.
By reading through little by little, you could learn quite a bit about
practical security on Linux, and by extension general security
principles. If you have not yet been bold enough to try Tripwire or
Kerberos, the recipes might give you that little extra boost of
confidence because it is so straightforward. Although I really like
the Snort 2.0 book, the recipe in this book makes starting it up and
using it pretty simple. The authors point out helpful details such as
which Linux distro (distribution) comes with Snort (e.g., SuSe) and
which does not (e.g., Red Hat). Not all Linux distros are created
equal.
There are almost 200 recipes in the book covering protecting files,
encrypting files, firewalls (iptables), authorization, network access
and the longest chapter: testing and monitoring. You are not left
hanging after you have tried a few recipes. This is quite
"pen-testing" (checking input/output validity), but it has a similar
flavor. For example, finding writable files, examining /proc, watching
traffic, checking on open ports, and other techniques are presented in
a simplified manner. If you are new to this, it is a good starting
point. Each recipe is organized nicely into problem, solution and
discussion and yes, with code or commands as needed,
This is highly recommended book to round out your Linux security
bookshelf, especially if you are a Microsoft admin seeking Linux knowledge
or a Linux admin seeking security knowledge.
====================================================================
Reader's Guide to Current Technical Literature in Security and
Privacy
====================================================================
The Reader's Guide from Past issues of Cipher is archived at
http://www.ieee-security.org/Cipher/ReadersGuide.html
A new reader's guide editor would be welcome.
====================================================================
Listing of academic positions available
by Cynthia Irvine
====================================================================
National ICT Australia, Formal Methods Program
Researcher/Senior Researcher
Formal Methods for Computer Security
http://nicta.com.au
National ICT Australia
Program Leader
Security and Trust Management Program
http://nicta.com.au
Florida International University, Miami, Florida
Four tenure-track positions in Computer Science
Evaluation begins January 15, 2004, continues until positions are filled
http://www.cs.fiu.edu/news/recruit03_04.php
Zurich Information Security Center
Swiss Federal Institute of Technology Zurich
Zurich, ZH
Research Position on FORMAL METHODS FOR SECURITY PROTOCOLS
Position open until filled
http://www.zisc.ethz.ch/jobs/index
These positions are listed at:
http://cisr.nps.navy.mil/jobscipher.html
This job listing is maintained as a service to the academic
community. If you have an academic position in computer security and
would like to have in it included on this page, send the following
information:
Institution,
City, State,
Position title,
date position announcement closes, and
URL of position description
to: irvine@cs.nps.navy.mil
---------------------------------------------------------------------
Contributed by Gene Spafford:
Purdue University, School of Technology
Track Position
Assistant, Associate, Full Professor
Digital Forensics and Information Security
Contact:
Dr. Melissa Dark, Chairman
Digital Forensics and Information Security Search Committee
401 North Grant Street - Knoy Room 467A
West Lafayette, IN 47907-2021
Or email to mjdark @ tech.purdue.edu
====================================================================
Interesting Links and Reports Available via FTP and WWW
====================================================================
"Reports Available" links from previous issues of
Cipher are archived at http://www.ieee-security.org/Cipher/NewReports.html
and http://www.ieee-security.org/Cipher/InterestingLinks.html
[This list has fallen out-of-date; contributions are welcome.]
====================================================================
Information on the Technical Committee on Security and Privacy
====================================================================
____________________________________________________________________
Information for Subscribers and Contributors
____________________________________________________________________
SUBSCRIPTIONS:
Two options, each with two options:
1. To receive the full ascii CIPHER issues as e-mail, send e-mail to
cipher-admin@ieee-security.org (which is NOT automated) with subject line
"subscribe".
OR
send a note to cipher-request@mailman.xmission.com with the
subject line "subscribe"
(this IS automated - thereafter you can manage your subscription
options, including unsubscribing, yourself)
2. To receive a short e-mail note announcing when a new issue of
CIPHER is available for Web browsing send e-mail to
cipher-admin@ieee-security.org (which is NOT automated) with subject line
"subscribe postcard".
OR
send a note to cipher-postcard-request@mailman.xmission.com with the
subject line "subscribe"
(this IS automated - thereafter you can manage your subscription
options, including unsubscribing, yourself)
To remove yourself from the subscription list, send e-mail to
cipher-admin@ieee-security.org with subject line "unsubscribe"
or, if you have subscribed directly to the xmission.com mailing list,
use your password (sent monthly) to unsubscribe per the instructions
at http://mailman.xmission.com/cgi-bin/mailman/listinfo/cipher or
http://mailman.xmission.com/cgi-bin/mailman/listinfo/cipher-postcard
Those with access to hypertext browsers may prefer to read Cipher
that way. It can be found at URL http://www.ieee-security.org/cipher.html
CONTRIBUTIONS:
to cipher @ ieee-security.org are invited. Cipher is a NEWSletter,
not a bulletin board or forum. It has a fixed set of departments,
defined by the Table of Contents. Please indicate in the
subject line for which department your contribution is intended.
Calendar and Calls-for-Papers entries should be sent to
cipher-cfp @ ieee-security.org
and they will be automatically included in both departments. To
facilitate the semi-automated handling, please send either a text
version of the CFP or a URL from which a text version can be easily
obtained. For Calendar entries, please include a URL and/or e-mail
address for the point-of-contact. For Calls for Papers, please submit
a one paragraph summary. See this and past issues for examples. ALL
CONTRIBUTIONS CONSIDERED AS PERSONAL COMMENTS; USUAL DISCLAIMERS
APPLY. All reuses of Cipher material should respect stated copyright
notices, and should cite the sources explicitly; as a courtesy,
publications using Cipher material should obtain permission from the
contributors.
____________________________________________________________________
Recent Address Changes
____________________________________________________________________
Address changes from past issues of Cipher are archived at
http://www.ieee-security.org/Cipher/AddressChanges.html
______________________________________________________________________
How to become <> a member of the
IEEE Computer Society's TC on Security and Privacy
________________________________________________________________________
You may easily join the TC on Security & Privacy by completing
the on-line for at IEEE at http://www.computer.org/TCsignup/index.htm
_____________________________________________________________
TC Publications for Sale
_____________________________________________________________
IEEE CS Press
Back issues of TC publications may be available; contact Jonathan
Millen for information about the Computer Security Foundations
Workshop.
________________________________________________________________________
TC Officer Roster
________________________________________________________________________
Chair: Past Chair:
Heather Hinton Mike Reiter
IBM Software Group - Tivoli Carnegie Mellon University
11400 Burnett Road ECE Department
Austin, TX 78758 Hamerschlag Hall, Room D208
(512)436 1538 (voice) Pittsburgh, PA 15213 USA
hhinton@us.ibm.com (412) 268-1318 (voice)
reiter@cmu.edu
Vice Chair: Chair, Subcommittee on Academic Affairs:
Jonathan Millen Prof. Cynthia Irvine
SRI International EL233 U.S. Naval Postgraduate School
Computer Science Laboratory Computer Science Department
333 Ravenswood Ave. Code CS/IC
Menlo Park, CA 94025 Monterey CA 93943-5118
512-838-0455 (voice) (408) 656-2461 (voice)
millen@csl.sri.com irvine@cs.nps.navy.mil
Chair, Subcommittee on Standards: Chair, Subcomm. on Security Conferences:
David Aucsmith Jonathan Millen
Intel Corporation SRI International EL233
JF2-74 Computer Science Laboratory
2111 N.E. 25th Ave 333 Ravenswood Ave.
Hillsboro OR 97124 Menlo Park, CA 94025
(503) 264-5562 (voice) 512-838-0455 (voice)
(503) 264-6225 (fax) millen@csl.sri.com
awk@ibeam.intel.com
Treasurer: Newsletter Editor:
Tom Chen Hilarie Orman
Dept of Electrical Engineering Purple Streak, Inc.
SMU, Dallas, TX 75275 500 S. Maple Dr.
(214) 768-8541 (voice) Salem, UT 84653
http://www.engr.smu.edu/~tchen (801) 423-1052 (voice)
cipher-editor@ieee-security.org
________________________________________________________________________
BACK ISSUES:
Cipher is archived at: http://www.ieee-security.org/cipher.html